Web API - how secure is the Key if it is placed here?

[Anonymous]

I am getting a token from my api to pass to another api.

I want to secure my key. If i place it in the Web API credential option for the Data Source, how secure is the key?

How is it stored? Is it encrypted when it is passed to the api? If i upload the workbook to PBIS, can other users see it (i assume i can use permission to control what level of user can/cannot see the key)?

Thank you.

[Nolock]

Hi @Anonymous,

if you want to save a token in a secure form, use the Web data connector in PowerQuery and set the Web API key. It will be stored in your User Profile. If you send this PBIX file to somebody else, they have to set the token again.

It is well described in the following article: https://blog.crossjoin.co.uk/2014/03/26/working-with-web-services-in-power-query/

[Anonymous]

Here is the quote in the blog:

"After this the API token gets stored separately from the query in the secure credentials store and you don’t need to enter it again each time the query runs; this also means that the API token will not travel with the workbook if you email it to someone else, for example."

which is great - but we would like to understnad more how this works. what is the "secure credentials store"? how does it interact between the PBIX (PBID) and PBIS?

[Nolock · Accepted solution]

Hi @Anonymous,

I see, hopefully this article https://docs.microsoft.com/de-de/power-bi/whitepaper-powerbi-security will help. The for you relevant part starts at https://docs.microsoft.com/de-de/power-bi/whitepaper-powerbi-security#data-at-rest.

[Anonymous]

English:

https://docs.microsoft.com/en-us/power-bi/whitepaper-powerbi-security#data-at-rest

Thank you, this is useful.

[Anonymous]

Thank you for the info. This is helpful, but for us, it is not a complete or "official" answer.

I have seen that blog. We are using Web API with the key, and assume it is best practrices and "secure", but we don't actually know waht theat means or how it works:

where is the key stored? how is it stored?

when someone downloads the workbook from PBIS, can they see the key in the workbook?

Thanks for the help, but we are looking for official documentation from MSFT on storing keys and keeping them secure --> secrets management in PBID (PBIX) and PBIS.

Thanks for the reply, this is useful, but we would like to get official documentation so we can be certian.

[Nolock]

Hi @Anonymous,

I've forgotten to mention how it works in PBI Service.

You have to set up either a gateway connection and/or data source credentials. Both are saved in the cloud and your users won't see the credentials.

More about that: https://docs.microsoft.com/en-us/power-bi/refresh-scheduled-refresh